EUVD-2026-79852
GHSA-rg45-c352-m33p
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Authentication bypass over HTTP needs no credentials or interaction, so PR:N/UI:N/AC:L; read-all with limited write gives C:H/I:L/A:N.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
2DescriptionNVD
Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security). The supported version that is affected is 11.2.26.0.000. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Hyperion Financial Management. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all Oracle Hyperion Financial Management accessible data as well as unauthorized update, insert or delete access to some of Oracle Hyperion Financial Management accessible data. CVSS 3.1 Base Score 8.2 (Confidentiality and Integrity impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N).
AnalysisAI
Unauthenticated remote attackers can bypass security controls in Oracle Hyperion Financial Management 11.2.26.0.000 over HTTP, gaining access to and limited modification of financial consolidation data managed by the application. Oracle rates it 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N), with high confidentiality impact and low integrity impact and no availability impact. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Required: network reachability to the Oracle Hyperion Financial Management 11.2.26.0.000 HTTP interface (AV:N) and the specific Security-component endpoint that fails to enforce authentication - no credentials, no user session, and no victim interaction are required per the vendor vector (PR:N/UI:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals here are internally consistent and point to a genuine, high-priority enterprise risk. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Primary remediation is to apply the Oracle Critical Patch Update that contains the fix for this CVE, available via the Oracle security alert at https://www.oracle.com/security-alerts/cspusep2026.html - the input does not provide an exact patched version number, so the specific fixed build for 11.2.26.x must be taken from that advisory (Oracle CPU fixes are cumulative and typically require applying the corresponding HFM/EPM patch set and restarting the managed servers). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today